Transformative Compliance Tactics: Getting to "Yes" in a Complex Regulatory World | The Ncast Episode 43

Stephanie Lyon, VP of Compliance at Ncontracts, joins Rafael DeLeon, SVP of Industry Relations at Ncontracts, on Ncast to review the 2026 compliance year and what compliance officers at community banks, credit unions, and other financial organizations should plan for in 2027. They cover why federal deregulation has not reduced compliance risk, how state laws and attorneys general are filling the gap, and where AI fits in compliance programs.

Ncontracts Chief Information Security Officer Clay Carter joins Rafael DeLeon on the Ncast to explain why security programs built to document diligence often fall short of reducing third-party risk. Carter built security programs at Nielsen, GE, and Xylem before joining Ncontracts, and he covers vendor questionnaires, patch management, incident response, and AI access controls for community banks, credit unions, and other financial organizations.In this episode, Carter and DeLeon discuss:Why a security program built to satisfy auditors can differ from one built to stop attackersWhy vendor questionnaires demonstrate diligence without building trust, and why financial organizations should know their top ten vendors personallyHow the shrinking window between vulnerability disclosure and exploitation changes patch management and incident responseWhat over-provisioned access and consumer AI tools mean for security teams, and what to require in an enterprise AI agreementTwo steps financial organizations can take tomorrow to reduce their security exposureDownload the Ncontracts Incident Response Plan Checklist: https://hubs.ly/Q04zTVQ20

From AI that acts without explicit approval to a regulatory environment that's pulling back on exams, Michael Berman — CEO and founder of Ncontracts — joins Rafael DeLeon to make the case that both forces are pointing financial organizations in the same direction: toward more risk, not less, and toward infrastructure that has to hold without an examiner asking for it.

Most vendor management programs at financial institutions are built to satisfy an examiner. Michael Carpenter, VP of Risk Management at Ncontracts and author of The Upside of Third-Party Risk Management, spent 30 years building third-party risk management programs at community banks, credit unions, and large financial institutions — and in this episode of Ncast, he explains what that experience revealed about why so many TPRM programs fail to deliver real business value.

Regulators aren't waiting for new rules before they start examining for compliance failures — they're applying existing frameworks to AI and vendor oversight right now, and wealth management firms that aren't prepared are already behind. Hollie Mason, Managing Director at Stout and former FINRA senior enforcement counsel, joins Rafael DeLeon to break down what the SEC and FINRA are prioritizing in 2026 exams, where the vendor oversight documentation gaps are showing up, and what defensible AI governance looks like for RIAs and broker-dealers.

The SEC's amended Regulation S-P raises the bar on how investment advisors protect customer data — and the compliance timeline isn't moving. In this episode of the Ncast, Rafael DeLeon sits down with Tracy Soehle, Associate General Counsel at the Investment Advisors Association, to work through what the rule demands in practice: building an incident response program, meeting the 30-day notification requirement, and managing service providers in a regulatory environment that still leaves a lot open to interpretation.For RIAs, this isn't just a compliance exercise. It runs directly through fiduciary duty — and Tracy walks through how firms can meet that obligation while navigating vendor relationships that don't always cooperate.In this episode:The two most significant changes in amended Reg S-P: mandatory incident response programs and the 30-day customer notification requirementWhy that 30-day clock is harder than it sounds — and what firms need in place before a breach happensWhat "reasonable assurances" from vendors actually means when the rule doesn't require it in the contractWhich service providers will renegotiate and which won't — and how to document the diligence either wayWhy you can delegate notification to a vendor but can't delegate the liabilityData mapping as the non-negotiable foundation of the entire programWhat SEC examiners are asking for and what "reasonably designed" has to mean in practiceTo get insights on how your peers are managing third-party risks, download our State of Third-Party Risk Management Survey: https://www.ncontracts.com/state-of-third-party-risk-management-survey-report

Compliance officers are under constant pressure to answer regulatory questions accurately — and fast. In this episode of Ncast, Rafael DeLeon sits down with Stephanie Lyon and Jay Jamison to unpack what it means to use AI in compliance responsibly, from how Nquiry was built to eliminate the research burden to what examiners actually want to see in your documentation when AI informed a decision.Guests: Stephanie Lyon — SVP of Regulatory & Risk Intelligence, Ncontracts Jay Jamison — Chief Product Officer, NcontractsIn this episode:• Why lean compliance teams are stuck playing compliance encyclopedia — and what that costs• What citations, current sourcing, and visible reasoning have to do with trust in any AI tool• The liability question: when an AI tool gets it wrong, who owns it?• How Nquiry's purpose-built regulatory library and integration with nComply sets it apart from general-purpose AI• What hallucination risk looks like beyond wrong answers — and why regulatory nuance is the harder problem• The examiner's checklist: what Rafael looked for at the OCC when institutions used third-party tools to support compliance decisions• How to tell whether your AI tool is reducing uncertainty or creating itLearn more about Nquiry: https://hubs.ly/Q04f3J8w0

AI is moving faster than most compliance programs can handle — and financial institutions are feeling it. In this episode of the Ncast, host Rafael DeLeon sits down with Ncontracts Chief Product Officer Jay Jamison to talk about what it actually means to govern AI responsibly in financial services.Jay brings nearly 30 years of software experience — including a decade at Microsoft — to a conversation that covers where institutions are going wrong with AI adoption, how to build a practical governance framework starting with your data, what your vendors may not be disclosing about the AI embedded in their products, and where risk and compliance programs are headed over the next three to five years.Whether you're a community bank CEO just getting curious or a compliance officer trying to keep pace with a fast-moving vendor landscape, this episode gives you a framework to move forward with confidence.

Former compliance and BSA officer Ashley Przada joins Rafael DeLeon to share hard-won lessons from 14 years in banking — covering everything from BSA risk and examiner relationships to compliance burnout and building programs from the ground up.

Compliance is often viewed as a gatekeeper instead of a collaborator. How can a compliance officer change that perception and actually become valued as a strategic business partner? In this episode of the Ncast podcast, Rafael DeLeon interviews Michelle Prohaska, Chief Risk & Compliance Officer at Nymbus, as she shares how she laid the groundwork to ensure compliance is welcomed into strategic conversations and partnerships.